Share this story

Google has banned dozens of Android apps downloaded millions of times from the official Play Store after researchers discovered they were being used to display phishing and scam ads or perform other malicious acts.

A blog post published by security firm Trend Micro listed 29 camera- or photo-related apps, with the top 11 of them fetching 100,000 to 1 million downloads each. One crop of apps caused browsers to display full-screen ads when users unlocked their devices. Clicking the pop-up ads in some cases caused a paid online pornography player to be downloaded, although it was incapable of playing content. The apps were carefully designed to conceal their malicious capabilities.

“None of these apps give any indication that they are the ones behind the ads, thus users might find it difficult to determine where they’re coming from,” Trend Micro Mobile Threats Analyst Lorin Wu wrote. “Some of these apps redirect to phishing websites that ask the user for personal information, such as addresses and phone numbers.”

The apps also hid their icons from the Android app list. That made it hard for users to uninstall the apps, since there was no icon to drag and delete. The apps also used compression archives known as packers to make it harder for researchers—or presumably, tools Google might use to weed out malicious apps—from analyzing the wares.

Your selfies are ours

Trend Micro researchers discovered another batch of apps that falsely promised to allow users to “beautify” their pictures by uploading them to a designated server. Instead of delivering an edited photo, however, the server provided a picture with a fake update prompt in nine different languages. The apps made it possible for the developers to collect the uploaded photos, possibly for use in fake profile pics or for other malicious purposes. The developers took pains to prevent users from detecting what was happening.

“The remote server used by these apps is encoded with BASE64 twice in the code,” Wu wrote. “In addition, several of these apps can also hide themselves via the same hidden technique mentioned above.”

The apps reported by Trend Micro are:

Indicators of Compromise (IoCs)

Package

Label

Installs

com.beauty.camera.years.pro

Pro Camera Beauty

1,000,000+

com.cartoon.art.photo.ygy.camera

Cartoon Art Photo

1,000,000+

com.lyrebirdstudio.emoji_camera

Emoji Camera

1,000,000+

art.eff.filter.photo.editor

Artistic effect Filter

500,000+

art.filter.editor.imge

Art Editor

100,000+

com.beauty.camera.project.cloud

Beauty Camera

100,000+

com.selfie.camerapro.pro

Selfie Camera Pro

100,000+

com.camera.beauty.kwok.horizon

Horizon Beauty Camera

100,000+

com.camera.ygysuper.photograph

Super Camera

100,000+

com.effects.art.photo.for.self

Art Effects for Photo

100,000+

com.solidblack.awesome.cartoon.art.pics.photo.editor

Awesome Cartoon Art

100,000+

com.photoeditor.artfilterphoto

Art Filter Photo

50,000+

com.photocorner.artfilter.arteffect.prizma

Art Filter Photo Effcts

10,000+

com.picfix.cartoonphotoeffects

Cartoon Effect

10,000+

com.picsartitude.arteffect

Art Effect

10,000+

com.csmart.photoframelab

Photo Editor

5,000+

com.wallpapers.nuclear.hd.hd3d.best.live.nuclear

Wallpapers HD

5,000+

com.perfectmakeup.magicartfilter.photoeditor.selfiecamera

Magic Art Filter Photo Editor

5,000+

appworld.fillartphotoeditor.technology

Fill Art Photo Editor

1,000+

com.artflipphotoediting

ArtFlipPhotoEditing

1,000+

com.artphoto.artfilter.artpiczone

Art Filter

1,000+

com.photoeditor.cartoonphoto

Cartoon Art Photo

1,000+

com.photoeditor.prismaeffects

Prizma Photo Effect

1,000+

com.cmds.artphotofiltereffect

Cartoon Art Photo Filter

100+

com.latestnewappzone.photoartfiltereditor

Art Filter Photo Editor

100+

com.livewallpaperstudio.pixture

Pixture

100+

app.pixelworlds.arteffect

Art Effect

50+

timepassvideostatus.photoarteffect.cartoonpainteffect

Photo Art Effect

10+

com.techbuzz.cartoonfilter

Cartoon Photo Filter

5+

The report is the latest to demonstrate that Google can’t be counted on to proactively detect malicious apps available in Play. That puts the onus on end users to carefully scrutinize apps before installing them. One way to do this is to read comments to see if anyone has reported suspicious things, such as receiving pop-up ads, after installing an app. Another important strategy is to limit downloads to those that are truly necessary or useful, and then only when they’re developed by a recognized company. Niche apps that provide little tangible benefit should be avoided.